The exposed thing here is not a server farm. It is a laptop with a Ray dashboard open on port 8265 and a browser tab pointed somewhere it should not have gone.
CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, citing evidence of active exploitation. The flaw sits in Ray, the open source compute engine used to spread AI training and model serving across machines, and it lets a malicious web page execute shell commands on the computer of a developer running Ray locally.
A web page that reaches into your own machine
Ray's defense against browser-driven attacks came down to a single check: does the request's User-Agent header start with "Mozilla"? The reasoning was that a real browser always sends one and a stray script does not. Firefox and Safari, though, let a page rewrite that header through the fetch API, so an attacker could simply answer the question correctly.
That gets paired with DNS rebinding, a technique where a domain the browser has already loaded is quietly re-pointed at 127.0.0.1, leaving the page talking to software running on the visitor's own computer. The result is code execution on the developer's machine, triggered by nothing more than visiting a malicious site, or loading a malicious ad, while Ray is running.
The Ray project rates it 9.4 out of 10 under CVSS v4, critical, and the National Vulnerability Database also carries an 8.8 on the older v3.1 scale. Every release before Ray 2.52.0 is affected. The project's own advisory credits JLLeitschuh of Socket and avilum of Oligo Security with the discovery.
The fix has been sitting there since November
That advisory went out on November 26, 2025, alongside the patched release. So the KEV listing is not word of a new bug. It is CISA saying that a bug fixed nearly nine months ago is being turned on people now, which means the population still at risk is precisely the population that never updated.
Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV entries on publicly exposed assets, and check whether an attacker got in before the patch went on. CISA's alert urges every other organization to work the catalog the same way. The agency ran the same play in July, when it flagged four flaws under active attack, one of them in the AI tool Langflow.
Upgrade to Ray 2.52.0 and switch the token on
Upgrade to Ray 2.52.0 or later. The patched release also adds optional token-based authentication for the dashboard, and optional is doing a lot of work in that sentence, so turn it on rather than filing it under things to get to. If you cannot upgrade right away, stop leaving the Ray dashboard running while you browse. Chrome's Local Network Access protections offer some cover that Firefox and Safari did not.
There is a pattern worth sitting with. AI infrastructure tends to arrive as developer tooling first and production software second, so the security assumptions of a local convenience end up guarding a machine that has cloud credentials on it. That is the same shape as the LiteLLM exposure that spilled secrets belonging to 2,500 companies.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.